Thanks to visit codestin.com
Credit goes to github.com

Skip to content
Draft
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Fix links
Signed-off-by: raihankhan <[email protected]>
  • Loading branch information
raihankhan authored and tamalsaha committed Jun 20, 2025
commit 187a375e3cafa4a1997e4b7fcc719e8a75ea25bd
78 changes: 2 additions & 76 deletions docs/guides/mongodb/recommendation/rotate-auth-recommendation.md
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ section_menu_id: guides

Rotating authentication secrets in database management is vital to mitigate security risks, such as credential leakage or unauthorized access, and to comply with regulatory requirements. Regular rotation limits the exposure of compromised credentials, reduces the risk of insider threats, and enforces updated security policies like stronger passwords or algorithms. It also ensures operational resilience by testing the rotation process and revoking stale or unused credentials. KubeDB provides `RotateAuth` which reduces manual errors, and strengthens database security with minimal effort. KubeDB Ops-manager generates Recommendation for rotating authentication secrets via this OpsRequest.

`Recommendation` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative recommendation for KubeDB managed databases like [MongoDB](https://www.elastic.co/products/mongodb) in a Kubernetes native way. The recommendation will only be created if `.spec.authSecret.rotateAfter` is set. KubeDB generates MongoDB Rotate Auth recommendation regarding two particular cases.
`Recommendation` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative recommendation for KubeDB managed databases like [MongoDB](https://www.mongodb.com/) in a Kubernetes native way. The recommendation will only be created if `.spec.authSecret.rotateAfter` is set. KubeDB generates MongoDB Rotate Auth recommendation regarding two particular cases.

1. AuthSecret lifespan is more than one month and, less than one month remaining till expiry
2. AuthSecret lifespan is less than one month and, less than one third of lifespan remaining till expiry
Expand Down Expand Up @@ -324,78 +324,4 @@ recommendation.supervisor.appscode.com/mongo-x-mongodb-x-rotate-auth-441xqs patc
- Learn how to configure [MongoDB Cluster](/docs/guides/mongodb/clustering/replicaset.md).
- Monitor your MongoDB database with KubeDB using [`out-of-the-box` Prometheus operator](/docs/guides/mongodb/monitoring/using-prometheus-operator.md).
- Use [private Docker registry](/docs/guides/mongodb/private-registry/using-private-registry.md) to deploy MongoDB with KubeDB.
- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md).


apiVersion: kubedb.com/v1
kind: Postgres
metadata:
labels:
app.kubernetes.io/instance: postgres
app.kubernetes.io/managed-by: Helm
app.kubernetes.io/name: postgreses.kubedb.com
name: postgres
namespace: pg
spec:
deletionPolicy: WipeOut
authSecret:
rotateAfter: 1h
podTemplate:
spec:
containers:
- name: postgres
resources:
limits:
cpu: 500m
memory: 1Gi
requests:
cpu: 500m
memory: 1Gi
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 70
runAsNonRoot: true
runAsUser: 70
seccompProfile:
type: RuntimeDefault
- name: pg-coordinator
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 70
runAsNonRoot: true
runAsUser: 70
seccompProfile:
type: RuntimeDefault
initContainers:
- name: postgres-init-container
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
runAsGroup: 70
runAsNonRoot: true
runAsUser: 70
seccompProfile:
type: RuntimeDefault
nodeSelector:
kubernetes.io/os: linux
securityContext:
fsGroup: 999
replicas: 3
storage:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 4Gi
storageClassName: local-path
storageType: Durable
version: "16.4"

- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md).
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,7 @@ section_menu_id: guides

TLS certificate rotation in databases is essential for maintaining security, ensuring compliance, and preventing service disruptions. Regular rotation mitigates risks like certificate expiry and key compromise, adapts to evolving cryptographic standards, and maintains trust relationships with Certificate Authorities. It also enhances operational resilience by testing renewal processes and ensures smooth auditing and monitoring. To minimize risks and streamline the process, KubeDB provides ReconfigureTLS OpsRequest support. KubeDB Ops-manager generates Recommendation to rotate TLS certificates via this OpsRequest when their expiry is near.

`Recommendation` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative recommendation for KubeDB managed databases like [MongoDB](https://www.mongo.co/products/mongodb) in a Kubernetes native way. KubeDB generates MongoDB/Opensearch Rotate TLS recommendation regarding if:
`Recommendation` is a Kubernetes `Custom Resource Definitions` (CRD). It provides a declarative recommendation for KubeDB managed databases like [MongoDB](https://www.mongodb.com/) in a Kubernetes native way. KubeDB generates MongoDB/Opensearch Rotate TLS recommendation regarding if:

- At least one of its certificate’s lifespan is more than one month and less than one month remaining till expiry

Expand Down Expand Up @@ -337,7 +337,7 @@ recommendation.supervisor.appscode.com/mongo-x-mongodb-x-rotate-tls-6ujvez patch
## Next Steps

- Learn about [backup & restore](/docs/guides/mongodb/backup/stash/overview/index.md) MongoDB database using Stash.
- Learn how to configure [MongoDB Topology Cluster](/docs/guides/mongodb/clustering/topology-cluster/simple-dedicated-cluster/index.md).
- Learn how to configure [MongoDB Cluster](/docs/guides/mongodb/clustering/replicaset.md).
- Monitor your MongoDB database with KubeDB using [`out-of-the-box` Prometheus operator](/docs/guides/mongodb/monitoring/using-prometheus-operator.md).
- Use [private Docker registry](/docs/guides/mongodb/private-registry/using-private-registry.md) to deploy MongoDB with KubeDB.
- Want to hack on KubeDB? Check our [contribution guidelines](/docs/CONTRIBUTING.md).